[Zeek] Capture Loss using pcap file

Vern Paxson vern at corelight.com
Thu Oct 10 13:00:42 PDT 2019


Hi Eva,

> ... Is it a
> problem with Zeek like to much data or was the loss already in the pcap and
> has nothing to do with Zeek?

The loss was already in the pcap.  When running on pcaps, Zeek does not
drop any packets present in the pcap.

		Vern


More information about the Zeek mailing list